# Logstash **URL:** https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=450 [Latest](https://discuss.elastic.co/latest.md) · [Categories](https://discuss.elastic.co/categories.md) · [Tags](https://discuss.elastic.co/tags.md) **Page:** 451 --- ## [Does logstash-filter-cidr support mutiple address match like if condition](https://discuss.elastic.co/t/does-logstash-filter-cidr-support-mutiple-address-match-like-if-condition/206882)
**Author:** [@tacyeh](https://discuss.elastic.co/u/tacyeh)\ **Replies:** 0\ **Last updated:** [November 7, 2019, 4:20am UTC](https://discuss.elastic.co/t/does-logstash-filter-cidr-support-mutiple-address-match-like-if-condition/206882 "2019-11-07T04:20:57Z")
I want add a field {"key" =\> "value1"} when address match "192.168.1.1/24", add a field {"key" =\> "value2"} when address match "192.168.2.1/24"..., but accord the reference, I wrote configs like this: filter { c… --- ## [Data Update from MYSQL not appear](https://discuss.elastic.co/t/data-update-from-mysql-not-appear/206512)
**Author:** [@dean92](https://discuss.elastic.co/u/dean92)\ **Replies:** 4\ **Last updated:** [November 7, 2019, 3:07am UTC](https://discuss.elastic.co/t/data-update-from-mysql-not-appear/206512 "2019-11-07T03:07:53Z")
hi all, I have one problem on my data. I export one table and a few column on my MYSQL to ES using logstash. there are one column(status\_ticket) in table is frequently change e.g: from status new to open/closed and it e… --- ## [LogStash:: How To Add a New Field, Then Populate It Based On Another Field's Value?](https://discuss.elastic.co/t/logstash-how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206193)
**Author:** [@redapplesonly](https://discuss.elastic.co/u/redapplesonly)\ **Replies:** 14\ **Last updated:** [November 7, 2019, 12:41am UTC](https://discuss.elastic.co/t/logstash-how-to-add-a-new-field-then-populate-it-based-on-another-fields-value/206193 "2019-11-07T00:41:10Z")
Hello Logstash Sorcerers, I am running Logstash v7.4.0 and Elasticsearch v7.4.0 in a nicely-working pipeline. My chain of fruit stores are sending my sales information to Logstash; Logstash then pushes that data to Ela… --- ## [LOGSTASH, simple code unable to get output in elasticsearch and kibana](https://discuss.elastic.co/t/logstash-simple-code-unable-to-get-output-in-elasticsearch-and-kibana/206848)
**Author:** [@santhosh\_l](https://discuss.elastic.co/u/santhosh_l)\ **Replies:** 4\ **Last updated:** [November 6, 2019, 9:40pm UTC](https://discuss.elastic.co/t/logstash-simple-code-unable-to-get-output-in-elasticsearch-and-kibana/206848 "2019-11-06T21:40:59Z")
Hello all, I am a beginner in elk, i am trying to execute logstash ( through power shell). when ever i execute the fallowing command :- C:\\siem\> .\\logstash-7.4.1\\bin\\logstash.bat -f .\\myfirst.conf the output on the p… --- ## [ERROR logstash/async.go:256 Failed to publish events caused by: lumberjack protocol error & client is not connected](https://discuss.elastic.co/t/error-logstash-async-go-256-failed-to-publish-events-caused-by-lumberjack-protocol-error-client-is-not-connected/206860)
**Author:** [@Sreekanth3](https://discuss.elastic.co/u/Sreekanth3)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 8:30pm UTC](https://discuss.elastic.co/t/error-logstash-async-go-256-failed-to-publish-events-caused-by-lumberjack-protocol-error-client-is-not-connected/206860 "2019-11-06T20:30:29Z")
I have enabled SSL on the logstash and I want to try validate logstash to elastic over ssl and filebeat to logstash with non-ssl . \`Connection to backoff(async(tcp://XXX.XXX.X.XXX:5045)) established\` \`Failed to … --- ## [CSV/Time Bug](https://discuss.elastic.co/t/csv-time-bug/206845)
**Author:** [@Jim\_Thunder](https://discuss.elastic.co/u/Jim_Thunder)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 7:25pm UTC](https://discuss.elastic.co/t/csv-time-bug/206845 "2019-11-06T19:25:31Z")
Hello! I have files being sent in CSV format. My logstash config ONLY parses them into different fields. It does nothing else. For some reason, whenever there is a date in the CSV file, the field that should contain th… --- ## [Logstash pipeline for csv file using filebeat](https://discuss.elastic.co/t/logstash-pipeline-for-csv-file-using-filebeat/206689)
**Author:** [@newbieELK](https://discuss.elastic.co/u/newbieELK)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 6:52pm UTC](https://discuss.elastic.co/t/logstash-pipeline-for-csv-file-using-filebeat/206689 "2019-11-06T18:52:10Z")
Hi, Spent too much time on this, would really appreciate any help. My csv file loading in one record. My data is csv: Number,Category,Assignment group,Technology,Assigned to,Opened,O\_Month,Opened Day,Opened Date,Opened… --- ## [Console XML works, but not file XML](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645)
**Author:** [@kcb](https://discuss.elastic.co/u/kcb)\ **Replies:** 8\ **Last updated:** [November 6, 2019, 6:24pm UTC](https://discuss.elastic.co/t/console-xml-works-but-not-file-xml/206645 "2019-11-06T18:24:18Z")
We have written a logstash script to process an XMLfile and export contents to stdout{}. We have verified the script works when the input is specified as stdin{} However, when we specify a file as the input, the XML doe… --- ## [Help Me Logstash Not Found 5044](https://discuss.elastic.co/t/help-me-logstash-not-found-5044/206846)
**Author:** [@Paulo\_Lima](https://discuss.elastic.co/u/Paulo_Lima)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 6:06pm UTC](https://discuss.elastic.co/t/help-me-logstash-not-found-5044/206846 "2019-11-06T18:06:08Z")
I have ELK 7.4.2 and all services running, but winlogbeat cannot send logs to Logstash, it seems that port (5044) is not listening. Do you know how I can solve this? Already released in Firewall, check the configuratio… --- ## [How to match multiple fields to single value with IF](https://discuss.elastic.co/t/how-to-match-multiple-fields-to-single-value-with-if/206844)
**Author:** [@Andrew22](https://discuss.elastic.co/u/Andrew22)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 5:49pm UTC](https://discuss.elastic.co/t/how-to-match-multiple-fields-to-single-value-with-if/206844 "2019-11-06T17:49:58Z")
I am trying to match multiple fields to a single value then mutate the field if necessary in a single if statement instead of having multiple different If statements For example: if \[1\] or \[2\] or \[3\] = null { mutate … --- ## [Custom plugin offline installation](https://discuss.elastic.co/t/custom-plugin-offline-installation/206840)
**Author:** [@ildefonso.gonzalez](https://discuss.elastic.co/u/ildefonso.gonzalez)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:52pm UTC](https://discuss.elastic.co/t/custom-plugin-offline-installation/206840 "2019-11-06T16:52:30Z")
Dear, After develop and install a custom plugin of logstash using version 7.3.0 (Java), we found the follow error on stratup server time when we invoke the method class on conf file: \[ERROR\] 2019-11-06 17:37:22.408 \[… --- ## [Logstash: import tables depending on colum name value](https://discuss.elastic.co/t/logstash-import-tables-depending-on-colum-name-value/206826)
**Author:** [@Asma\_Sassi](https://discuss.elastic.co/u/Asma_Sassi)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 3:48pm UTC](https://discuss.elastic.co/t/logstash-import-tables-depending-on-colum-name-value/206826 "2019-11-06T15:48:45Z")
I'm actually working on migrating mysql data to elasticsearch and had successfully imported tables to ES. And now I have another task which is more complicated, I have table A structure and its data like schema below: … --- ## [Change the type of an index field during ingestion](https://discuss.elastic.co/t/change-the-type-of-an-index-field-during-ingestion/206831)
**Author:** [@kailash](https://discuss.elastic.co/u/kailash)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 4:10pm UTC](https://discuss.elastic.co/t/change-the-type-of-an-index-field-during-ingestion/206831 "2019-11-06T16:10:29Z")
I am using Fix Protocol plugin (open source by Connamara). One field NoMDEntries is created as Structure/Object. However, we want it to be of type nested. Changing it using PUT results in error reason": "object mapping \[… --- ## [How to parse and iterate consecutive XML same id tag values](https://discuss.elastic.co/t/how-to-parse-and-iterate-consecutive-xml-same-id-tag-values/206817)
**Author:** [@asad\_ali](https://discuss.elastic.co/u/asad_ali)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 3:20pm UTC](https://discuss.elastic.co/t/how-to-parse-and-iterate-consecutive-xml-same-id-tag-values/206817 "2019-11-06T15:20:44Z")
I have an xml where the xpath I'm interested eted in looks like as /get\_reports\_response\[1\]/report\[1\]/report\[1\]/results\[1\]/result\[12\] and under result i have children like \[name: \] \[owner: +\] \[name: \] \[comment: \] \[… --- ## [Huawei Firewall Log](https://discuss.elastic.co/t/huawei-firewall-log/206815)
**Author:** [@SiggiK](https://discuss.elastic.co/u/SiggiK)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 3:00pm UTC](https://discuss.elastic.co/t/huawei-firewall-log/206815 "2019-11-06T15:00:55Z")
Hello, we need to process logs from a Huawei USG9560 firewall (provider grade machine). The logs come in a binary format. Is there a way to read such log date with Logstash? Rgds, Siggi --- ## [Help please - Elasticsearch not start CentOs 7](https://discuss.elastic.co/t/help-please-elasticsearch-not-start-centos-7/206811)
**Author:** [@Paulo\_Lima](https://discuss.elastic.co/u/Paulo_Lima)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 2:57pm UTC](https://discuss.elastic.co/t/help-please-elasticsearch-not-start-centos-7/206811 "2019-11-06T14:57:14Z")
Please help me, I have the following error when starting the service \[root@jcnslcapp9005 ~\]# service elasticsearch status ● elasticsearch.service - Elasticsearch Loaded: loaded (/etc/systemd/system/elasticsearch.serv… --- ## [Add field depending of the dstip](https://discuss.elastic.co/t/add-field-depending-of-the-dstip/206568)
**Author:** [@donetz](https://discuss.elastic.co/u/donetz)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 2:42pm UTC](https://discuss.elastic.co/t/add-field-depending-of-the-dstip/206568 "2019-11-06T14:42:20Z")
Hi community! I'm using logstash to process some data and I'm in trouble!! This is my situation: I'm reading alerts witg Filebeat from a file that has been written by a SIEM. I'm receiving these alerts with logstash a… --- ## [【Logstash】 I want to calculate the difference of field value](https://discuss.elastic.co/t/logstash-i-want-to-calculate-the-difference-of-field-value/206727)
**Author:** [@yokoyoko](https://discuss.elastic.co/u/yokoyoko)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 2:37pm UTC](https://discuss.elastic.co/t/logstash-i-want-to-calculate-the-difference-of-field-value/206727 "2019-11-06T14:37:24Z")
Prerequisite Monitoring server access logs with logstash. want to do Calculate the difference between the time field values ​​in the log (end\_time-start\_time). And I want to add the result to the new field as \[support\_t… --- ## [514 port or IP address, I don't understand](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744)
**Author:** [@lgllrd](https://discuss.elastic.co/u/lgllrd)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 2:31pm UTC](https://discuss.elastic.co/t/514-port-or-ip-address-i-dont-understand/206744 "2019-11-06T14:31:16Z")
Hi it's again me ! Now I'm trying to listen the port 514 with udp, it's for syslog. Of course I've searched on the internet and all the port under 1024 are privileged. Alright so I'm trying the setcap command and I have… --- ## [Implementing ECS with custom fields](https://discuss.elastic.co/t/implementing-ecs-with-custom-fields/204184)
**Author:** [@widhalmt](https://discuss.elastic.co/u/widhalmt)\ **Replies:** 3\ **Last updated:** [November 6, 2019, 2:29pm UTC](https://discuss.elastic.co/t/implementing-ecs-with-custom-fields/204184 "2019-11-06T14:29:38Z")
Hi, We contributed the icinga module for Filebeat and started developing a Logstash pipeline for parsing Icinga logs: https://github.com/Icinga/icinga-logstash-pipeline. It seems like there are far too many different ru… --- ## [Duplicated data](https://discuss.elastic.co/t/duplicated-data/206606)
**Author:** [@AstroSlazak](https://discuss.elastic.co/u/AstroSlazak)\ **Replies:** 1\ **Last updated:** [November 6, 2019, 1:37pm UTC](https://discuss.elastic.co/t/duplicated-data/206606 "2019-11-06T13:37:01Z")
Hi, I am using jdbc to grab data from SQL, and it works, kind of. I have default index XXXXXX but from database i want to create a new index. output { if \[type\] == "stops" or \[type\] == "signon" { elasticsearch { … --- ## [Kv filtering problem](https://discuss.elastic.co/t/kv-filtering-problem/206277)
**Author:** [@abu.sayeed](https://discuss.elastic.co/u/abu.sayeed)\ **Replies:** 8\ **Last updated:** [November 6, 2019, 11:30am UTC](https://discuss.elastic.co/t/kv-filtering-problem/206277 "2019-11-06T11:30:55Z")
message" =\> "SENT =\> Status : \[SENT\] | CID/GID : \[20799461/ABC\] | OBID : \[08824\] | SID : \[02471\] | StatusMsg : \[null\]", I wish the following fields Status =\> SENT, CID/GID =\> 20799461/ABC, OBID =\> 08824, SID =\> 024… --- ## [Enabling logstash centralised pipeline management](https://discuss.elastic.co/t/enabling-logstash-centralised-pipeline-management/203968)
**Author:** [@kiran\_kumar1](https://discuss.elastic.co/u/kiran_kumar1)\ **Replies:** 14\ **Last updated:** [November 6, 2019, 9:25am UTC](https://discuss.elastic.co/t/enabling-logstash-centralised-pipeline-management/203968 "2019-11-06T09:25:15Z")
Hi Team, I am trying to enabling logstash centralised pipeline management I have configured below settings into logstash.yml xpack.security.enabled: true xpack.management.enabled: true xpack.management.elasticsearch… --- ## [Unable to start logstash 7.4.1 in windows](https://discuss.elastic.co/t/unable-to-start-logstash-7-4-1-in-windows/206754)
**Author:** [@lohit18](https://discuss.elastic.co/u/lohit18)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 9:02am UTC](https://discuss.elastic.co/t/unable-to-start-logstash-7-4-1-in-windows/206754 "2019-11-06T09:02:44Z")
Hello Guys, I'm unable to start logstash 7.4.1 in windows machine getting follow error in command prompt .... i.e.., follows PS C:\\Users\\abc\\Downloads\\ELK\_7.4.1\> .\\logstash-7.4.1\\bin\\logstash -f .\\simpleconf.conf "co… --- ## [How can I use ECS with custom JSON input?](https://discuss.elastic.co/t/how-can-i-use-ecs-with-custom-json-input/206753)
**Author:** [@janoliver](https://discuss.elastic.co/u/janoliver)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 8:56am UTC](https://discuss.elastic.co/t/how-can-i-use-ecs-with-custom-json-input/206753 "2019-11-06T08:56:46Z")
Hi there! I have a server that collects metrics (such as CPU, memory, etc.) from other servers and I'd like to send that already collected data via logstash to elastic. At the moment, I have a TCP input with JSON encodi… --- ## [Logstash startup error when GREP\_OPTIONS set?](https://discuss.elastic.co/t/logstash-startup-error-when-grep-options-set/206743)
**Author:** [@ankh](https://discuss.elastic.co/u/ankh)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 7:58am UTC](https://discuss.elastic.co/t/logstash-startup-error-when-grep-options-set/206743 "2019-11-06T07:58:06Z")
Noticed some strange behaviour today on our Redhat boxes that we run Logstash on. I was trying to start Logstash jobs that previously ran fine, and got the error: Error: Could not find or load main class -Xms5g After … --- ## [Is there any way to pass start and end index of file in s3 input plugin](https://discuss.elastic.co/t/is-there-any-way-to-pass-start-and-end-index-of-file-in-s3-input-plugin/206738)
**Author:** [@Adarsh\_Kumar1](https://discuss.elastic.co/u/Adarsh_Kumar1)\ **Replies:** 0\ **Last updated:** [November 6, 2019, 7:16am UTC](https://discuss.elastic.co/t/is-there-any-way-to-pass-start-and-end-index-of-file-in-s3-input-plugin/206738 "2019-11-06T07:16:32Z")
I want to read filename and start\_index and end\_index from aws SQS queue (with sqs input plugin ) and pass this information to s3 input plugin that will read the particular file from start\_index and end\_index of file. I… --- ## [Log stash error](https://discuss.elastic.co/t/log-stash-error/206141)
**Author:** [@Seetharaman\_K](https://discuss.elastic.co/u/Seetharaman_K)\ **Replies:** 21\ **Last updated:** [November 6, 2019, 6:53am UTC](https://discuss.elastic.co/t/log-stash-error/206141 "2019-11-06T06:53:32Z")
below is the error i get while running logstash Sending Logstash logs to C:/busapps/rrsb/gbl1/logstash/7.0.0/logs which is now configured via log4j2.properties \[2019-11-01T10:04:00,538\]\[WARN \]\[logstash.config.source.m… --- ## [Calculate elapsed time for multiple end events](https://discuss.elastic.co/t/calculate-elapsed-time-for-multiple-end-events/205319)
**Author:** [@Patrick\_Gell](https://discuss.elastic.co/u/Patrick_Gell)\ **Replies:** 2\ **Last updated:** [November 6, 2019, 4:50am UTC](https://discuss.elastic.co/t/calculate-elapsed-time-for-multiple-end-events/205319 "2019-11-06T04:50:32Z")
Hello, I have a message driven system where one message is sent to multiple receiver. Now I wanted to track the time it takes for every receiver until the message arrives. The structure of my log entries looks like: T… --- ## [Update record if present otherwise insert](https://discuss.elastic.co/t/update-record-if-present-otherwise-insert/206310)
**Author:** [@mbrown007](https://discuss.elastic.co/u/mbrown007)\ **Replies:** 11\ **Last updated:** [November 6, 2019, 2:14am UTC](https://discuss.elastic.co/t/update-record-if-present-otherwise-insert/206310 "2019-11-06T02:14:07Z")
Here is my logstash configuration input { file { path =\> "/etc/logstash/fish/10gFresh.csv" start\_position =\> "beginning" sincedb\_path =\> "/dev/null" } } filter { csv { … [Previous page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=449) [Next page](https://discuss.elastic.co/c/elastic-stack/logstash/14.md?page=451)